postgres.git / summary / log / commit / refs

commit    24aed2124a5273e4cb543b06d4b7bb2c2ad5bf3c
Author:   Noah Misch <noah@leadboat.com>
Date:     Mon Sep 21 00:42:27 2015 +0000
First released in: 9.6.0, 9.0.23, 9.1.19, 9.2.14, 9.3.10, 9.4.5, 9.5.0

    Restrict file mode creation mask during tmpfile().
    
    Per Coverity.  Back-patch to 9.0 (all supported versions).
    
    Michael Paquier, reviewed (in earlier versions) by Heikki Linnakangas.


 src/bin/pg_dump/pg_backup_tar.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/bin/pg_dump/pg_backup_tar.c b/src/bin/pg_dump/pg_backup_tar.c
index b060cf8d0b5..51adf7917e1 100644
--- a/src/bin/pg_dump/pg_backup_tar.c
+++ b/src/bin/pg_dump/pg_backup_tar.c
@@ -375,8 +375,18 @@ tarOpen(ArchiveHandle *AH, const char *filename, char mode)
 	}
 	else
 	{
+		int			old_umask;
+
 		tm = calloc(1, sizeof(TAR_MEMBER));
 
+		/*
+		 * POSIX does not require, but permits, tmpfile() to restrict file
+		 * permissions.  Given an OS crash after we write data, the filesystem
+		 * might retain the data but forget tmpfile()'s unlink().  If so, the
+		 * file mode protects confidentiality of the data written.
+		 */
+		old_umask = umask(S_IRWXG | S_IRWXO);
+
 #ifndef WIN32
 		tm->tmpFH = tmpfile();
 #else
@@ -411,6 +421,8 @@ tarOpen(ArchiveHandle *AH, const char *filename, char mode)
 		if (tm->tmpFH == NULL)
 			die_horribly(AH, modulename, "could not generate temporary file name: %s\n", strerror(errno));
 
+		umask(old_umask);
+
 #ifdef HAVE_LIBZ
 
 		if (AH->compression != 0)


[parent: eed5bbc48026]